Network management interface

ABSTRACT

A method for communicating over a specified protocol enabling bi-directional streaming between a network manager and a network device is provided. The method includes receiving, at data processing hardware of a network device, a request from the network manager requesting data including at least one of state information or configuration information. The request includes a get request to obtain a snapshot of the requested data existing on the network device or a subscribe request to subscribe to updates for the requested data existing on the network device. The method also includes transmitting a data response from the data processing hardware to the network manager via telemetry. The data response includes the requested data having data elements defined by at least one data schema supported by the network device. The capability and data requests and the capability and data responses adhere to a protocol configured to enable bi-directional streaming between the network manager and the network device.

TECHNICAL FIELD

This disclosure relates to network management interfaces.

BACKGROUND

Network management interfaces allow network management systems tointeract with network devices (e.g., routers) for provisioning changesto configurations thereon, as well as retrieving data from the networkdevices. A network management system may require multiple protocols forthe provisioning of device configurations and the retrieval of stateinformation. For instance, a Network Configuration protocol such asNETCONF is generally well-suited for facilitating the provisioning ofconfiguration data, but requires the retrieval of state information froma network device to be polled separately. On the other hand, SimpleNetwork Management Protocol (SNMP) allows for the transfer of stateinformation from a network device to a network management system, but isgenerally a poor choice for updating a configuration of the networkdevice.

Moreover, existing network management interfaces generally only supportthe transfer of data modeled in a specified schema-definition language.For instance, the SNMP protocol only transfers ASN.1 modelled data,while the NETCONF protocol uses YANG as the schema-definition languagefor modeling configuration and state data, and XML as the only dataencoding. However, modern network devices transitioning to automatedinteractions for the provisioning of configuration data have evolved tosupport the transfer of data in multiple formats, such as data models ina standard schema-definition language (e.g., YANG), an industry standardformat, or some other structure.

SUMMARY

One aspect of the disclosure provides a method for communicating over aspecified protocol enabling bi-directional streaming between a networkmanager and a network device. The method includes receiving, at dataprocessing hardware of a network device, a request from the networkmanager requesting data including at least one of state information orconfiguration information. The request includes a get request to obtaina snapshot of the requested data existing on the network device or asubscribe request to subscribe to updates for the requested dataexisting on the network device. The method also includes transmitting adata response from the data processing hardware to the network managervia telemetry. The data response includes the requested data having dataelements defined by at least one data schema supported by the networkdevice. The capability and data requests and the capability and dataresponses adhere to a protocol configured to enable bi-directionalstreaming between the network manager and the network device.

Implementations of the disclosure may include one or more of thefollowing optional features. In some implementations, the methodincludes receiving, at the data processing hardware, a capabilityrequest from the network manager for capability information on thenetwork device and transmitting, from the data processing hardware ofthe network device, a capability response including the capabilityinformation to the network manager via telemetry. The capabilityinformation may include one or more data schemas supported by thenetwork device, encodings supported by the network device, and a versionof a network management interface service supported by the networkdevice.

In some examples, the get request specifies a set of paths identifyingthe requested data within one or more schema definition modelsrestricted by the at least one of the data schemas supported by thenetwork device for use by the network device when returning therequested data to the network manager. The get request may also specifyat least one of the encodings supported by the network device for use bythe network device when serializing the set of paths.

Transmitting the data response may include transmitting a get responseincluding a corresponding notification message for each path specifiedby the get request. Each notification message may include the snapshotof the requested data for the corresponding path and a timestamp fieldindicating a time at which the network device took the snapshot of therequested data for the corresponding path. The subscribe request mayspecify a set of paths identifying the requested data within one or moreschema definition models restricted by the at least one data supportedby the network device and a subscription mode that indicates triggersfor the network device to return the updates for the requested data tothe network manager. Transmitting the data response may includetransmitting a subscribe response including an update field includingone or more notification messages each providing an update value for acorresponding path specified by the subscribe request.

When the subscription mode specified by the subscribe request includes aperiodically-polled subscription, the method may include retrieving, bythe data processing hardware, the requested data on a per-data elementbasis from memory hardware in communication with the data processinghardware at a transmission time of the subscribe request andencapsulating, by the data processing hardware, the requested data intothe subscribe response. When the subscription mode specified by thesubscribe request includes a one-off subscription, the method mayinclude retrieving, by the data processing hardware, the requested dataon a per-data element basis for each corresponding path specified by thesubscribe request without requiring serialization of the paths specifiedby the subscribe request simultaneously and encapsulating, by the dataprocessing hardware, the requested data into the subscribe response viamultiple notification messages. In some examples, transmitting thesubscribe response includes, when the subscription mode specified by thesubscribe request includes a Stream subscription, transmitting thesubscribe response each time the update value for the corresponding pathspecified by the subscribe request changes or transmitting the subscriberesponse during a sample interval specified by the Stream subscription,wherein the subscribe response includes a timestamp indicating a time atwhich the requested data was sampled.

The method may also include receiving, at the data processing hardware,a set request from the network manager and determining, by the dataprocessing hardware, whether the network manager is able to process thespecified one or more operations. The set request may specify one ormore operations for the network device to process. When the networkmanager is able to process the operations specified by the networkmanager, the method includes processing, by the data processinghardware, the operations and transmitting a set response from the dataprocessing hardware to the network manager. The set response may includea corresponding update result response for each of the processedoperations. The update result message may indicate a value for thecorresponding processed operation and path of an element of therequested data modified by the corresponding processed operation. Whenthe network manager is unable to process at least one of the operationsspecified by the network manager, the method may include transmittingthe set response from the data processing hardware to the networkmanager. The set response may include a message field providing an errormessage indicating that the network manager is unable to process theoperations specified by the set request.

One or more operations specified by the set request may include at leastone of a delete operation, an update operation or a replace operation.The method may also include, prior to transmitting the data response tothe network manager, in response to receiving the data request,authenticating, by the data processing hardware, the network manager.The method may also include determining, by the data processinghardware, whether the network manager is authorized to access thenetwork device for the requested data. The network manager may transmitthe data response to the network manager when the network manager isauthorized and authenticated.

Another aspect of the disclosure provides a network system forcommunicating over a specified protocol enabling bi-directionalstreaming between a network manager and a network device. The networksystem includes a network manager, a network device, data processinghardware in communication with the network device and memory hardware incommunication with the data processing hardware. The memory hardwarestores instructions that when executed on the data processing hardwarecause the data processing hardware to perform operations. The operationsinclude receiving a request from the network manager requesting datacomprising at least one of state information, configuration information,or operational information and transmitting a data response to thenetwork manager via telemetry. The request includes a get request toobtain a snapshot of the requested data existing on the network deviceor a subscribe request to subscribe to updates for the requested dataexisting on the network device. The data response includes the requesteddata having data elements defined by at least one data schema supportedby the network device. The capability and data requests and thecapability and data responses may adhere to a protocol configured toenable bi-directional streaming between the network manager and thenetwork device.

This aspect may include one or more of the following optional features.In some implementations, the operations include receiving a capabilityrequest from the network manager for capability information on thenetwork device and transmitting a capability response comprising thecapability information to the network manager via telemetry. Thecapability information may include one or more data schemas supported bythe network device, encodings supported by the network device, and aversion of a network management interface service supported by thenetwork device.

The get request may specify a set of paths identifying the requesteddata within one or more schema definition models restricted by the atleast one of the data schemas supported by the network device for use bythe network device when returning the requested data to the networkmanager. The get request may also specify at least one of the encodingssupported by the network device for use by the network device whenserializing the set of paths. Transmitting the data response may includetransmitting a get response including a corresponding notificationmessage for each path specified by the get request. Each notificationmessage may include the snapshot of the requested data for thecorresponding path and a timestamp field indicating a time at which thenetwork device took the snapshot of the requested data for thecorresponding path.

The subscribe request may specify a set of paths identifying therequested data within one or more schema definition models restricted bythe at least one data supported by the network device and a subscriptionmode that indicates triggers for the network device to return theupdates for the requested data to the network manager. Transmitting thedata response may include transmitting a subscribe response comprisingan update field including one or more notification messages eachproviding an update value for a corresponding path specified by thesubscribe request.

In some examples, the operations include, when the subscription modespecified by the subscribe request includes a periodically-polledsubscription, retrieving the requested data on a per-data element basisfrom the memory hardware at a transmission time of the subscribe requestand encapsulating the requested data into the subscribe response. Theoperations may also include, when the subscription mode specified by thesubscribe request includes a one-off subscription, retrieving therequested data on a per-data element basis for each corresponding pathspecified by the subscribe request without requiring serialization ofthe paths specified by the subscribe request simultaneously andencapsulating the requested data into the subscribe response viamultiple notification messages. Transmitting the subscribe response mayinclude, when the subscription mode specified by the subscribe requestincludes a Stream subscription, transmitting the subscribe response eachtime the update value for the corresponding path specified by thesubscribe request changes or transmitting the subscribe response duringa sample interval specified by the Stream subscription, wherein thesubscribe response includes a timestamp indicating a time at which therequested data was sampled.

The operations may also include receiving a set request from the networkmanager and determining whether the network manager is able to processthe specified one or operations. The set request may specify one or moreoperations for the network device to process. When the network manageris able to process the operations specified by the network manager, theoperations include processing the operations and transmitting a setresponse to the network manager. The set response may include acorresponding update result response for each of the processedoperations, the update result message indicating a value for thecorresponding processed operation and path of an element of therequested data modified by the corresponding processed operation.

The operations may also include, when the network manager is unable toprocess at least one of the operations specified by the network manager,transmitting the set response to the network manager. The set responsemay include a message field providing an error message indicating thatthe network manager is unable to process the operations specified by theset request. The one or more operations specified by the set request mayinclude at least one of a delete operation, an update operation, or areplace operation. The operations may further include, prior totransmitting the data response to the network manager, in response toreceiving the data request, authenticating the network manager anddetermining whether the network manager is authorized to access thenetwork device for the requested data. The network manager may transmitthe data response to the network manager when the network manager isauthorized and authenticated.

The details of one or more implementations of the disclosure are setforth in the accompanying drawings and the description below. Otheraspects, features, and advantages will be apparent from the descriptionand drawings, and from the claims.

DESCRIPTION OF DRAWINGS

FIG. 1A is a schematic view of an example network device creating atelemetry signal for transmission over a network to a network managementsystem.

FIG. 1B is a schematic view of an example network management systemtransmitting and receiving communications to and from a plurality ofnetwork devices.

FIG. 2A is a schematic view of an example network device authorizing andauthenticating a network management system requesting access to thenetwork device.

FIG. 2B is a schematic view of an example network device transmitting acapability response including capability information to a networkmanagement system.

FIG. 3 is a schematic view of an example network device receiving a getrequest from a network management system and returning a get response tothe network management system.

FIG. 4A is a schematic view of an example network device receiving a setrequest specifying one or more operations for the network device toprocess.

FIG. 4B is a schematic view of the network device of FIG. 4Atransmitting a set response including at least one update resultresponse after processing the one or more operations.

FIG. 5A is a schematic view of an example network device receiving asubscribe request from a network management system for subscribing toupdates for data existing on the network device.

FIG. 5B is a schematic view of the network device of FIG. 5Atransmitting a subscribe response including one or more notificationmessages each providing an update value for a corresponding pathspecified by the subscribe request.

FIG. 6 is a schematic view of a diagram of example operations performedby a network management system and a network device when the networkmanagement system requests a communication with the network device overa specified protocol.

FIG. 7 is a schematic view of an example computing device.

FIG. 8 is a flowchart of an example method for communicating between anetwork management system and a network element.

Like reference symbols in the various drawings indicate like elements.

DETAILED DESCRIPTION

Interfaces used for interacting with network devices have evolved fromthose that require human-interaction for the provisioning ofconfiguration data on the network devices. Implementations herein aredirected toward a common interface that supports the efficient transferof state information from a network device (e.g., a router or otheraccess point) to a network management system, as well as allow thenetwork management system to modify and/or retrieve the configuration onthe network device. Accordingly, the network management system may use aspecified protocol to retrieve both state information and configurationinformation from the network device, as well as modify the configurationdata (i.e., read-write data) on the network device without relying on ahuman to provision the configuration data. The common interface allowsfor bi-directional telemetry streams between the network managementsystem and the network device, while providing interaction with amultitude of different schema-definition languages that may be modeledon the network device.

Referring to FIG. 1A, in some implementations, a system 100, 100 aincludes a network device 120 communicating with a remote system 140over a network 130. The remote system 140 may be a distributed system(e.g., cloud environment) having scalable/elastic resources 142. Theresources 142 include computing resources 144 and/or storage resources146. In some implementations, the remote system 140 executes a networkmanagement system (NMS) 110 that specifies a protocol for transmittingand receiving communications 20 to and from the network device 120. Thespecified protocol enables bidirectional communications 20 between theNMS 110 and the network device 120. As used herein, a communication 20refers to a request message 22 the NMS 110 transmits over the network130 to the network device 120 using telemetry, or a response message 24the network device 120 transmits over the network 130 to the NMS 110using telemetry. As used herein, the term “telemetry” refers tostreaming data 21 corresponding to data 21 requested by the NMS 110 inthe request message 22, or data 21 retrieved by the network device 120and returned/transmitted to the NMS 110 in the response message 24. Thetelemetry data 21 may include configuration information 342, stateinformation 344, and/or operational information 346 associated with thenetwork device 120 for use by the NMS 110.

The protocol specified by the NMS 110 for communicating with the networkdevice 120 allows the NMS 110 to view the operational state and/or theconfiguration of the network device 120. In some implementations, theNMS 110 executes changes to the operational state and/or theconfiguration of the network device 120. Accordingly, the network device120 may transmit telemetry data 21 containing the configuration and/oroperating state of the network device 120 at a given time to the NMS110, and the NMS 110 may provision configuration data 21 for networkdevice 120 as needed without the need of the network device 120requiring human-interaction (e.g., network administrator) to provisionthe configuration of the network device 120.

The network device 120 includes a device communicating with otherdevices, systems, and/or networks. For instance, the network device maycorrespond to a router, a switch, a remote node, a firewall, a securitydevice, an access point, a thermostat, a modem, or any othercommunication device that may process and/or forward network traffic.The network device 120 may be a standalone device or may be operativelyconnected to a user device 102 for connecting the user device 102 to thenetwork 130. In some examples, the user device 102 (e.g., a desktopcomputer or laptop) implements the network device 120. Thus, the networkdevice 120 may correspond to other communication devices such as acomputing device, a mobile device, or some other user terminal.

In some implementations, the specified protocol enabling thebi-directional telemetry communications 20 includes a Remote ProcedureCall (RPC) configured to allow the NMS 110 to retrieve and modify theconfiguration of the network device 120, as well as control and generatethe telemetry streams of data 21 from the network device 120 to the NMS110 via the network 130. In some examples, the specified protocol is angRPC-based protocol that allows a single implementation on both the NMS110 and the network device 120 to interact with one another viatelemetry and configuration RPCs. All messages within the gRPC servicedefinition are defined as protocol buffers (e.g., proto3 protocolbuffer). The protocol may carry payloads containing data instances ofOpenConfig YANG schemas, or any data instances with characteristicshaving (1) a structure that can be represented by a tree structure wherenodes can be uniquely identified by a path including node names, or nodenames coupled with attributes, and (2) values capable of beingserialized into a scalar object. For instance, values may be serializedto a scalar object through encoding as a JavaScript Object Notation(JSON) string, a byte-array, a serialized protobuf object, or some otherdefined serialization. Accordingly, streaming telemetry is a paradigmfor network monitoring in which data 21 is streamed bi-directionallybetween the network device 120 and the NMS 110 continuously withefficient, incremental updates. In the examples of FIGS. 5A and 5B, theNMS 110 subscribes to specific data instances of the network device 120identified by path names using data models (e.g., data schemas)supported by the network device 120.

FIG. 1A shows the NMS 110 using the specified protocol to transmit acommunication 20 in the form of a request 22 over the network 130 to thenetwork device 120. Here, the NMS 110 transmits the request 22 to queryand/or modify data 21 on the network device 120, or operate as acollector for streamed data 21 output from the network device 120. Therequest 22 may include streaming telemetry data 21 corresponding to thefollowing RPCs: a CapabilityRequest 220 (FIG. 2B); a GetRequest 320(FIG. 3); a SetRequest 420 (FIG. 4A); or a SubscribeRequest 520 (FIG.5A).

On the other hand, FIG. 1A shows the network device 120 using thespecified protocol (e.g., gRPC) to transmit a communication 20 in theform of a response 24 over the network 130 to the NMS 110 in response toreceiving the request 22. The network device 120 transmits the response24 to provide data 21 requested by the NMS 110 in the request 22, or toprovide changes made to the underlying data 21 on the network device120. The response 24 may include streaming telemetry data 21corresponding to the following RPCs: a CapabilityResponse 240 (FIG. 2B);a GetResponse 340 (FIG. 3); a SetResponse 440 (FIG. 4B); or aSubscribeResponse 540 (FIG. 5B).

In some implementations, the network device 120 executes a telemetryprocess 150 for streaming the data 21 in real-time via telemetry. Thetelemetry process 150 includes a Define Policy step 152, a ConfigureEncoder step 154, and a Stream Data step 156 for streaming the data 21to the NMS 110. At the Define Policy Step, the telemetry process 150defines a streaming frequency for streaming the data 21. The DefinePolicy step 152 may determine a schema path of the data 21 to bestreamed, create a policy file having a description, identifier, andversion, and add the path to a policy file for encoding at the ConfigureEncoder step 154. The path may be specified by the NMS 110 in therequest 22 received by the network device 120.

At the Configure Encoder step 154, the telemetry process 150 specifies aformat for the collected data 21 and encodes the data 21 using thespecified schema. For instance, the telemetry process 150 may encode thedata 21 using a protocol buffer compact encoding to convert the policypaths into proto files, and thereafter, configure the telemetry forstreaming the data 21. In other examples, the telemetry process 150 mayencode the data 21 using JSON and protocol buffer key-values beforeconfiguring the telemetry for streaming the data 21.

In some examples, the NMS 110 specifies the format for the networkdevice 120 to use in the request 22. At the Stream Data step 156, thetelemetry process 150 streams the encoded data 21 to the NMS 110. Theencoded telemetry data 21 may include the configuration information 342,the state information 344, and/or operational information 346 associatedwith the network device 120 for use by the NMS 110.

Referring to FIG. 1B, in some implementations, a system 100, 100 bincludes the NMS 110 using the specified protocol (e.g., gRPC protocol)for transmitting and receiving telemetry communications 20 to and from aplurality of network devices 120, 120 a-n. Here, each communication 20transmitted from the NMS 110 to each network device 120 contains arequest 22 to query and/or modify data 21 on the corresponding networkdevice 120, or operate as a collector for streamed data 21 output fromthe corresponding network device 120. Similarly, each communication 20received by the NMS 110 from the network devices 120 contains acorresponding response 24 including data 21 requested by the NMS 110 orupdates that indicate changes made to the underlying data 21 on thecorresponding network device 120.

A communication session between the NMS 110 and the network device 120must be encrypted and neither the NMS 110 nor the network device 120 mayrevert back to unencrypted channels during the communication session. Insome examples, the communication session is encrypted using TransportLayer Security (TLS) that supports a multitude of methods for exchangingkeys, encrypting data 21, and authenticating message integrity betweenthe NMS 110 and the network device 120. In some examples, connectionsfor new communication sessions are mutually authenticated. For instance,the NMS 110 and the network device 120 may each validate digitalcertificate from the other entity to ensure that the remote entity isboth known, and authorized to connect to the local entity.

In some implementations, a network device 120 authenticates an RPCrequest 22 from the NMS 110. Referring to FIG. 2A, a schematic view 200a shows the NMS 110 streaming an RPC request 22 to the network device120 that contains an identifier 222 and a password 224 in the metadata21 of the RPC request 22 (e.g., the CapabilityRequest 220, theGetRequest 320, the SetRequest 420, or the SubscribeRequest 520). Thenetwork device 120 may determine if the identifier 222 is authorized torequest the corresponding RPC operation, and if determine if thepassword 224 is authenticated to request the corresponding RPCoperation. If the identifier 222 is authorized and the password 224 isauthenticated, the network device 120 may authenticate and authorize theNMS 110 access to the network device 120 for performing thecorresponding RPC operation specified in the request 22. Otherwise, thenetwork device 120 may provide an error message in a response 24informing the NMS 110 that the identifier 222 is not authorized and/orthe password 224 is not authenticated. In examples when the NMS 110 onlyprovides the identifier 222 in the RPC request 22, the network device120 only authorizes the RPC request 22 without requiring the networkdevice 120 to authenticate a password 224.

Referring to FIG. 2B, the NMS 110 uses the CapabilityRequest 220 toobtain capability information 230 from the network device 120. TheCapabilityRequest 220 is an RPC used by the NMS 110 and the networkdevice 120 as an initial handshake to exchange capability information230. In some implementations, when the NMS 110 transmits theCapabilityRequest 220 to the network device 120, the network device 120must reply with a CapabilityResponse 240 containing the capabilityinformation 230 for the network device 120. The capability information230 includes a supported models field 242, a supported encodings field244, and a network management interface (NMI) version field 246.

The supported models field 242 includes a set of model data messageseach associated with a specific data model supported by the networkdevice 120. As used herein, a data model refers to a data schema settingforth a data structure (e.g., data tree) for data 21 associated with thenetwork device 120. Each model specified by a corresponding model datamessage may refer to a specific data schema, a bundle of modules, or anaugmentation or deviation. Accordingly, each model data message containsa name field associated with the name of the model expressed as astring, an organization filed associated with the organizationpublishing the model expressed as a string, and a version fieldassociated with the supported version of the model expressed as a stringwhich represents the semantic version of a catalog entry. Thecombination of name, organization, and version uniquely identifies anentry in the model catalog.

The data tree supported by the network device 120 is defined by a set ofdata schemas and the NMS 110 may obtain these data schemas supported bythe network device 120 so that NMS 110 can generate valid modificationsto the data tree, and interpret the data 21 returned by Get andSubscribe RPC calls. In some examples, the NMS 110 obtains the set ofmodel data messages from the supported models field 242 for subsequentlyrestricting a set data schemas used by the network device 120 so thatthe NMS 110 may validate data 21 returned from the network device 10against a specific set of data schemas. Here, the NMS 110 may validatethe data 21 even if the network device 120 adds new values to restrictedvalue data elements (e.g., those representing an enumerated type), oraugment new data elements into the data tree. In some implementations,the NMS 110 specifies the schemas/models for use by the network device120 in subsequent GetRequest 320 and/or SubscribeRequest 520 RPCstransmitted to the network device 120. In these implementations, thenetwork device 120 must utilize data tree elements defined in dataschema models outside the specified set of models specified by the NMS110 when responding with corresponding GetResponse 340 and/orSubscribeResponse 540 RPCs returned to the NMS 110.

The supported encodings field 244 included in the CapabilityResponse 240contains an enumeration field associated with the data encodingssupported by the network device 120. For instance, the network device120 may support JSON encodings such in the case that a data item at aspecified path is a leaf node (e.g., has no children) the value of theleaf is encoded directly, i.e., no JSON object is required and a bareJSON value is included. Conversely, when the data item has child nodes,the value field contains a serialized JSON entity (e.g., object orarray) corresponding to the referenced item. The NMI version field 246may specify the semantic version of the service supported by the networkdevice 120, as specified as a string.

Referring to FIG. 3, in some implementations, the NMS 110 transmits theGetRequest 320 to the network device 120 to obtain a snapshot of data 21(e.g., configuration or state) existing on the network device 120. Thenetwork device 120 may collect and transmit the data 21 to the NMS 110in the GetResponse 340. Accordingly, the GetRequest 320 allows the NMS110 to request a set of paths for the network device 120 to serializeand transmit to the NMS 110. In response to receiving the GetRequest320, the network device 120 serializes the requested paths and returnsthe GetResponse 340. Here, the GetResponse 340 must reflect the valuesof the specified leaves at a particular collection time, which may bedifferent for each path specified in the GetRequest 320. In someimplementations, the network device 120 closes the channel establishedby the GetRequest 320 upon transmitting the GetResponse 340 to the NMS110.

Generally, the NMS 110 uses the GetRequest 320 RPC to retrieve arelatively small set of data 21 from the network device 120 as acomplete object, e.g., as part of the configuration. Accordingly, theGetRequest 320 is not expected to place a significant resource burden onthe network device 120 when retrieving the data 21. As the networkdevice 120 is expected to return an entire snapshot of the requesteddata in the GetResponse 340 RPC, the GetRequest 320 is not well-suitedfor retrieving very large data sets, such as the full contents of therouting table or the entire component inventory of the network device120. Instead, the NMS 110 may use the SubscribeRequest 520 RPC of FIG.5A when it is desirable to retrieve large data sets from the networkdevice 120.

The GetRequest 320 may include a list of paths field, a type field, anencoding field, and a data model field. The list of paths fieldidentifies a set of paths for which the NMS 110 is requesting a datasnapshot from the network device 120. The path may use wildcards, and inthe case that a specified path is not valid, the network device 120 mustpopulate an error field in the GetResponse 340 indicating the invalidpath. In some examples, the GetRequest 320 includes a prefix for eachpath within the GetRequest 320.

In some implementations, paths are represented according to OpenConfigPath Conventions, a simplified form of XPATH. Here, the path isrepresented by an ordered list of strings, beginning with the root node,and ending at the most specific path element. Each path may be presentedwith an element field, including a set of path elements encoded asstrings, and an origin field, which may be used to disambiguate the pathif necessary (e.g., the origin may be used to indicate whichorganization defined the data schema associated with the path).Accordingly, each path element should correspond to a node in the datatree (e.g., data structure). For example, the path/a/b/c/d may beencoded as:

Path: <  element: “a”  element: “b”  element: “c”  element: “d” <

Moreover, attributes may be specified alongside the node name within thepath element. For example, a node specified by/a/e[key=k1]/f/g wouldinclude a path encoded as:

Path: <  element: “a”  element: “e[key=k1]”  element: “f”  element: “g”<

Paths defined with the concatenation of the Prefix and Path andspecified within the RPC request 22 (e.g., GetRequest 320, SetRequest420, or SubscribeRequest 520) must be absolute such that no RPCs withrelative paths are generated. Additionally, the root node (‘/’) may beindicated by encoding a single path element as an empty string asfollows:

Path: <  element: “” <

The type field indicates the type of data 21 requested from the networkdevice 120. The type may include configuration information 342, stateinformation 344, and/or operational information 346 for the networkdevice 120. The configuration information 342 includes readable and/orwritable properties (e.g., read/write data 21) on the network device 120and may be represented by a specific set of schema models supported bythe network device 120. For instance, if the data schema includes YANG,the configuration information 342 may correspond to a “config true” setof leaves on the network device 120. On the other hand, the stateinformation 344 includes read-only data on the network device 120. InYang, the state information 344 may correspond to a “config false” setof leaves on the network device 120. However, some data schemas mayexpress the state information 344 as text (e.g., On, Off, Fault) whileother data schemas may express the state information as integers (e.g.,0, 1, 2). The state information 344 may also be more specific thansimply indicating On/Off/Fault states for the network device 120. Forinstance, the state information 344 may indicate whether or not thenetwork device 120 is transmitting/receiving or provide a value for thesignal strength of the network device 120. The operational information346 includes read-only data 21 on the network device 120 that is relatedto software processes operating on the network device 120, or externalinteractions on the network device 120.

For each path specified by the GetRequest 320, the GetResponse 340returned to the NMS 110 from the network device 120 provides acorresponding Notification message that includes a timestamp 350 fieldindicating a time at which the network device 120 took a snapshot of thedata 21 for the corresponding path. For instance, FIG. 3 shows theGetResponse 340 returning a Notification message including a snapshot ofdata 21 at timestamp TS 350 for a first path specified in the GetRequest320. Here, the data 21 may include any of the configuration information342, the state information 344, and/or the operational information 346specified in the type field of the GetRequest 320. In scenarios when theGetRequest 320 does not specify the type of data 21, the network device120 may return each of the configuration information 342, the stateinformation 344, and the operational information 346 in the treeresulting from the query associated with the GetRequest 320 from the NMS110. The GetResponse 340 may include additional Notification messagesfor each additional path when the GetRequest 320 provides a list ofpaths. The snapshot of data 21 includes a snapshot of configurationinformation 342, state information 344, and/or operational information346 for the network device 120. In some implementations, the GetResponse340 does not collapse data from multiple paths into a singlenotification within the GetResponse 340.

The timestamp TS 350 field of the GetResponse 340 may be represented asa number of nanoseconds since a Unix epoch (e.g., Jan. 1, 1970 00:00:00UTC), and is generally encoded as a signed 64-bit integer (int64). Asthe timestamp TS 350 returned in the GetResponse 340 is associated withan entire set of data 21, individual data items may have beensampled/retrieved by the network device 120 at different times.Accordingly, the NMS 110 may use the SubscribeRequest 520 RPC of FIG. 5Ato request a telemetry stream (e.g., SubscribeResponse 540 of FIG. 5B)when the NMS requires higher accuracy for individual data items of theretrieved data set.

The GetResponse 340 may also a prefix field and/or an alias field. Theprefix is a prefix applied to all encoded path fields included in theGetResponse 340. Generally, the prefix always precedes the pathelements. For instance, the paths expressed within the GetResponse 340may be formed by the concatenation of prefix+path. The alias is a stringproviding an alias for the prefix specified within the GetResponse 340.In some scenarios, the NMS 110 or network device 120 desires to usealiases for a particular path such subsequent RPCs (e.g., GetResponse340, SetResponse 440, and/or SubscribeResponse 540) can be compressedutilizing the alias, rather than using a complete representation of thepath. Thus, the use of the alias may remove redundant information toreduce a total message length of the subsequent RRCs. In examples whenthe network device 120 fails to provide support path aliases, a maximumlength of the subsequent RPCs should be considered, especially in termsof bandwidth utilization, and the efficiency of message generation.Moreover, a path alias may be encoded as a string and have a nameprefixed with a # character to avoid clashing between valid data pathsand aliases. The network device 120 may specify the aliases as fullyexpanded paths so that a single alias lookup is sufficient to resolve anabsolute path.

In some implementations, the GetResponse 340 provides an Error messageto indicate errors in the GetRequest 320 received by the network device120 from the NMS 110. The Error messages are represented by a canonicalRPC (e.g., gRPC) error code for a specified programming language (e.g.,Java, Golang, C++). In some examples, the network device 120 specifies afree-text string indicating the context of the error to allow the NMS110 to generate log entries that allow a human operator to understandthe exact error that occurred, as well as the context of the error.Generally, the network device 120 will choose the canonical error codebased on an expected behavior of the NMS 110 upon receiving the Errormessage in the GetResponse 340. For instance, error codes indicatingthat the NMS 110 may subsequently retry sending the GetRequest 320 maybe used when retrying the GetRequest 320 is expected to result in adifferent outcome, i.e., a valid outcome. The Error message may includea code, message, and data fields. The code corresponds to an unsigned32-bit integer value corresponding to the canonical gRPC code and themessage includes the human-readable string describing the errorcondition in greater detail. Here, the string is not expected to bemachine-parsable, but rather provide contextual information which may bepassed to other upstream systems or devices. The data provides anarbitrary sequence of bytes to provide further contextual informationrelating to the error. This arbitrary sequence of bytes may be encodedas proto.Any.

Referring to FIGS. 4A and 4B, in some implementations, the NMS 110transmits a SetRequest 420 RPC (FIG. 4A) to the network device 120 thatspecifies one or more operations 442 for the network device 120 toprocess, and after processing each of the operations 442, the networkdevice 120 returns a corresponding SetResponse 440 RRC (FIG. 4B)providing an UpdateResult message 446 (FIG. 4B) for each of theprocessed operations 442. The NMS 110 may transmit the SetRequest 420 tothe network device 120 to modify the state of the network device 120,and the network device 120 processes the operations 442 specified in theSetRequest 420

FIG. 4A shows SetRequest 420 RPC transmitted to the network device 120including operational fields of Delete 422, Replace 424, and/or Update426 to specify the one or more operations 442 for processing by thenetwork device 120. The SetRequest 420 may specify a prefix that isapplied to all paths defined within the fields 422, 424, 426 of theSetRequest 420. The Delete field 422 specifies a set of paths forremoval from the data tree of the network device. As with the set ofpaths specified in the GetRequest 320 RPC of FIG. 3, each path in theDelete field 422 of the SetRequest 420 may be represented by an orderedlist of strings, beginning with the root node, and ending at the mostspecific path element. Each path may be presented with an element field,including a set of path elements encoded as strings, and an originfield, which may be used to disambiguate the path if necessary (e.g.,the origin may be used to indicate which organization defined the dataschema associated with the path). Accordingly, each path element shouldcorrespond to a node in the data tree (e.g., data structure)

The Replace field 424 provides a set of Update messages that specifyelements/paths of the data tree whose content is to be replaced. TheUpdate field 426 provides a set of Update messages indicatingelements/paths of the data tree whose content is to be updated. In someexamples, the Replace field 424 and/or the Update field 426 utilizes are-usable Update message to indicate changes to paths where a new valueis required. An Update message may include a path field, providing anencoded path indicating the path of an element to be modified (e.g.,replaced or updated), and a value field, providing an encoded valueindicating the value applied to the specified node such that the node isupdated based upon the context of the Update message. Generally, theReplace and Update fields 424, 426 of the SetRequest 420 specifychanges/modifications to the read-write values (e.g., configurationinformation 342) on the network device 120. The operations 442 specifiedin the Replace field 424 must consider the behavior regarding anyomitted data elements in the Update field 426 based on whether theomitted data elements refer to non-default values (e.g., set by aprevious SetRequest 420), or unmodified defaults. When the Replace field424 omits previously-set values, these values must be treated as deletedfrom the data tree. Otherwise, omitted data elements must be createdwith their default values on the network device 120. On the other hand,the operations 442 specified in the Update field 426 only treat thevalue of those data elements explicitly specified therein as changed.

For both replace and update operations 442, if the path specified in thecorresponding path field does not exist, in some implementations, thenetwork device 120 creates a data tree element and populates the datatree element with data 21 included in the Update message specified inthe corresponding Replace field 424 or the corresponding Update field426 when the path does not exist. When invalid values are specified, thenetwork device 120 may cease processing updates within the SetRequest420, return the data tree to the state prior to any changes, and returnthe SetResponse 440 indicating the error associated with the invalidvalue.

The network device 120 treats the received SetRequest 420 as atransaction by processing the operations 442 (e.g., delete, replace,and/or update) contained therein. In some implementations, the networkdevice 120 processes the deleted paths (i.e., as specified in the Deletefield 422), followed by the paths to be replaced (i.e., as specified inthe Replace field 424), and lastly the paths to be updated (i.e., asspecified in the Update field 426). The network device 120 must considerthe order of Replace and Update fields 424, 426 included in a singleSetRequest 420. For instance, if a single path is specified multipletimes for a single operation 442 within the Replace field 424 or theUpdate field 426, then the state of the network device 120 must reflectthe application of all of the operations 442 in order, even if theoperations 442 overwrite one another.

Where a path is contained within the Delete field 422 of the SetRequest420, it should be removed from the data tree of the network device 120.In examples when the path specified corresponds to an element havingchildren, these children must be recursively deleted. In someimplementations, the use of wildcard paths must be expanded by thenetwork device 120, and the corresponding elements of the data treedeleted. In these implementations, such wildcards must support pathsspecifying a subtree of attributes required to identify entries within acollection (e.g. list, array, or map) of the data schema.

All changes corresponding to the state of the network device 120included in an individual SetRequest 420 are considered part of atransaction. In other words, either all modifications with theSetRequest 420 are processed by the network device 120, or the networkdevice 120 must rollback the state changes to reflect the state of thenetwork device 120 before any changes were applied. Accordingly, thenetwork device 120 does not reflect a change until all changes have beenaccepted and processed successfully. Hence, telemetry update messages(e.g., SetResponse 440) must not reflect a change in state until suchtime as the intended modifications to the underlying data 21 have beenaccepted by the network device 120. Accordingly, a “transaction” refersto a single SetRequest 420 specifying a set of changes to be appliedtogether and encapsulated within the single SetRequest 420.

FIG. 4B shows SetResponse 440 RPC transmitted to the NMS 110 after thenetwork device 120 processes the operations 442 specified in thereceived SetRequest 420 of FIG. 4A. The SetResponse 440 may specify theprefix that is applied to all paths defined within the fields 422, 424,426 of the SetRequest 420. In some implementations, the SetResponse 440includes a Message field 444 and an UpdateResult field 446.

The Message field 444 generally indicates the completion status of theentire transaction processed by the network device 120. Thus, theMessage field 444 indicates whether the network device 120 successfullyprocessed all of the operations 442 specified by the SetRequest 420. Forinstance, the Message field 444 may provide an error message when anupdate was not successfully applied to the contents of the data 21. TheError message may include the code, message, and data fields asdescribed above with respect to the Error message of the GetResponse 340of FIG. 3. The error message may include an error code of “ok” when themodifications/changes to the data 21 for the entire transaction weresuccessful. In some implementations, when the NMS 110 transmits theSetRequest 420, and the network device 120 is unable to apply/processany of the specified changes, the network device 120 reports the errormessage in the Message field 444 of the SetResponse 440 as well as inthe UpdateResult field 446 under an Error field 545 for an individualoperation associated with the error. Accordingly, the network device 120determines an entire transaction fails when network device 120 fails toprocess any operation 442 specified by the SetRequest 420. Here, theerror code for the Message field 444 may be set to Aborted, while theerror code for the Error field 454 within the UpdateResult field 446associated with the failed operation 442 may be set to Error.

The UpdateResult field 446 provides a list of UpdateResult responses 446a-n each associated with a corresponding operation 442 specified by theSetRequest 420 in the Delete, Replace, and Update fields 422, 424, and426, respectively. For instance, a first UpdateResult response 446 acontains a timestamp TS field 450, a path field 448, the operation 442,and the error field 454 for the underlying operation 442 specified bythe SetRequest 420. As with the timestamp TS field 350 for theGetResponse 340 of FIG. 3, the timestamp field 450 includes an encodedtimestamp indicating the time at which the SetRequest 420 RPC wasaccepted by the network device 120. The path field 448 includes the pathspecified by the SetRequest 420 (e.g., within one of the Delete,Replace, or Update fields 422, 424, 426) for the corresponding operation442, and in scenarios when the SetRequest 420 fails to use a commonprefix, the network device 120 may specify a prefix to reduce repetitionof path elements within other ones of the UpdateResult responses 446 n.The Operation field 442 provides the operation (e.g., a value equal toone of Delete, Replace, or Update) corresponding to the specified pathin the path field 448.

The Error field 454 provides the error message when the network device120 fails to, or is otherwise unable to, process the correspondingoperation 442. The Error message may include the code, message, and datafields as described above with respect to the Error message of theGetResponse 340 of FIG. 3. The Error field 454 may set the error codedto “ok” when the operation 442 is successful. In some examples, theerror message within the Error field 454 is set to “Unauthorized” whenthe NMS 110 specifies metadata in the SetRequest 420 requiringauthentication by the network device 120 to perform the correspondingoperation. On the other hand, the Error field 454 may be set to“PermissionDenied” when the NMS 110 does not have permission to modifythe path specified by the corresponding operation 442. Moreover, whenthe underlying operation 442 specifies a path that cannot be parsed bythe network device 120, the Error field 454 may be set to“InvalidArgument” such that the message field of the Error messageincludes human-readable text indicting that the path associated with theunderlying operation 442 could not be parsed. In implementations whenthe operation 442 is an update or replace operation specifying aninvalid path, the Error field 454 may be set to “NotFound” such that themessage field of the Error message includes human-readable textindicting that the path associated with the underlying operation 442 isinvalid. Moreover, the Error field 454 may be set to “InvalidArgument”when the operation 442 is an update or replace operation that includesan invalid value within the corresponding Update message in the Replacefield 424 or Update field 426 of the corresponding SetRequest 420.Generally, the “InvalidArgument” error code is used in scenarios whenthe payload specifies scalar values that do not correspond to thecorrect schema type, and in scenarios when multiple values are specifiedusing a particular encoding (e.g., JSON) which cannot be decoded by thenetwork device 120.

Referring to FIGS. 5A and 5B, in some implementations, the NMS 110transmits a SubscribeRequest 520 RPC (FIG. 5A) to the network device 120that specifies one or more updates associated with the state of data 21(e.g., data instances) on the network device 120, and the network device120 returns ongoing SubscriptionResponse 540 RPCs (FIG. 5B) eachrelating to the state of the data tree (e.g., configuration, state,and/or operational) specified by the SubscribeRequest 520. TheSubscribeRequest 520 may specify a subscription mode 532 that indicatestriggers for updates for data 21 sent from the network device 120 in theSubscribeResponse 540. All requests for new subscriptions may beencapsulated within the SubscribeRequest 520 RPC. The SubscribeRequest520 may specify the subscription mode 532 to include one of a ONCEsubscription 532 a, a STREAM subscription 532 b, or a POLL Subscription532 c. The ONCE subscription 532 a includes a subscription having adedicated stream (e.g., telemetry) to return one-off data 21 from thenetwork device 120 to the NMS 110. The STREAM subscription 532 bcorresponds to a long-lived subscription that streams data 21 upon theoccurrence of triggers specified by the STREAM subscription 532 b. ThePOLL subscription 532 c uses a stream to periodically request a set ofdata 21 from the network device 120.

FIG. 5A shows the NMS 110 transmitting a SubscribeRequest 520 to requestupdates from the network device 120 for a specified set of paths. TheSubscribeRequest 520 may include a Subscribe field 522, a Poll field524, and an Aliases field 526. The Aliases field 526 allows the NMS 110to create an alias for the network device 120 to use for a specifiedpath. The Aliases field 526 may include an AliasList message specifyinga list of aliases represented by a target path (encoded path) for eachalias, and the alias defined by the NMS 110 for the corresponding path.In scenarios when the network device 120 is unable to support the aliasdefined by the NMS 110, the network device 120 may return aSubscribeResponse 540 having the error field 546 set to one of anInvalidArgument error code when the specified alias is not acceptable tothe network device, an AlreadyExists error code when the alias is aduplicate of an existing alias, a ResourceExhausted error code when thenetwork device 120 has insufficient memory or processing resources tosupport the alias, or an Unknown error code in all other scenarios.

The Subscribe field 522 includes a SubscriptionList message 530 having aSubscription field 531, a Mode field 532, a Prefix field 533, aUse_aliases field 534, a qos field 535, an Allow_aggregation field 536,and a Use_models field 537. Only the Subscription field 531 may berequired by the NMS 110 in the SubscriptionList message 530. Theremaining fields 532-537 may be optional.

The Subscription field 531 in the SubscriptionList message 530 includesa set of Subscription messages indicating the new set of paths the NMS110 is subscribing to on the network device 120. A Subscription messagegenerically describes a set of data 21 that is to be subscribed to bythe NMS 110, and includes a corresponding path. There is no requirementthat the path specified by a Subscription message currently exist withinthe data tree on the network device 120, and therefore, the networkdevice 120 will not close the channel with the NMS 110, and insteadcontinue to monitor for the existence of the path at some time in thefuture. In some examples, the network device 120 transmits aSubscribeResponse 540 that populates an error field 546 (FIG. 5B) set to“NotFound” to inform the NMS 110 that the path does not exist at thetime of subscription creation. For the STREAM and POLL subscriptions 532b, 532 c, respectively, the NMS 110 may optionally specify additionalparameters within the Subscription message.

The Mode field 532 provides the type of subscription including one ofthe ONCE subscription 532 a, the STREAM subscription 532 b, or the POLLSubscription 532 c. In some examples, the default value for the Modefield 532 is the STREAM subscription 532 b. The NMS 110 may create theONCE subscription 532 a by setting the Mode field 532 to the ONCEsubscription 532 a. A ONCE subscription 532 a acts as a singlerequest/response channel. For instance, the network device 120 maycreate and transmit a relevant SubscribeResponse 540 and close thechannel after the SubscribeResponse 540 is transmitted.

In some implementations, the NMS 110 creates the STREAM subscription 532b by transmitting the SubscribeRequest 520 to the network device 120with the Mode field 532 set to the STREAM subscription 532 b (shown inFIG. 5A). Each entry within the Subscription message of the Subscriptionfield 531 may be specified with one of an On Change mode or a Sampledmode. A STREAM subscription 532 b specified with the “On Change” modeonly sends data updates when the value of the data 21 changes. Aheartbeat interval may be specified along with an “On Change” STREAMsubscription 532 b. Here, the value of the data item(s) is re-sent onceper heartbeat interval regardless of whether the value has changed ornot. On the other hand, a STREAM subscription 532 b specified with the“Sampled” mode includes sample interval encoded as an unsigned 64-bitinteger representing nanoseconds. The network device 120 may send thevalue of the data item(s) once per sample interval to the NMS 110. Whenthe network device 120 is unable to support the sample interval, thenetwork device rejects the STREAM subscription by returning theSubscribeResponse 540 with the error field 546 set an error messageindicating the InvalidArgument error code. In examples when the sampleinterval is set to zero, the network device 120 must create thesubscription and transmit the data 21 via telemetry using the lowestpossible interval.

In some examples, the Subscription message of the Subscription field 531for the STREAM subscription 532 b optionally includes asuppress_redundant flag that when set to true, the network device 120will not generate any telemetry updates unless the value of the pathreported on changes since the last update. Generally, updates must onlybe generated for individual leaf nodes in the subscription that havechanged. For instance, a subscription to/a/b—where there are leaves cand d branching from the b node, an update for c must be generated andan update for d must not be generated if the value of c has changed, butd remains unchanged. Additionally or alternatively, a heartbeat_intervalmay be specified to modify the behavior of the suppress-redundant fieldin a sampled STREAM subscription 532 b. Here, the network device 120generates one telemetry update per heartbeat interval regardless ofwhether the suppress_redundant flag is set to true. The heartbeatinterval may include a value specified as an unsigned 64-bit integer innanoseconds.

In some implementations, the NMS 110 creates a subscription specifying atarget defined mode that allows the network device 120 to select thebest type of subscription to be created on a per-data element basis. Forinstance, if the path specified within the Subscription message refersto some leaves which are event driven (e.g., the state of the networkdevice changes based upon an external trigger), than the network device120 may create the “On Change” STREAM subscription 532 b. On the otherhand, data associated with counter values may cause the network device120 to create the Sampled STREAM subscription 532 b.

In some implementations, the NMS 110 creates the POLL subscription 532 cfor on-demand retrieval of statistics via long-lived channels. The POLLsubscription 532 c specifies a set of subscribed paths and is initiatedby transmitting the SubscribeRequest 520 to the network device 120 suchthat the Subscription messages of contained within the Subscriptionfield 531 of the SubscriptionList 530 indicate the set of paths that areof interest to the NMS 110. In some examples, the NMS 110 transmits theSubscribeRequest 520 with the Poll field 524 containing an empty Pollmessage. In these examples, the network device generates updates for allthe corresponding paths within the SubscriptionList 530 upon receptionof the SubscribeRequest 520.

The Prefix field 533 provides a common prefix that is applied to allpaths specified within the SubscriptionList message 530, and may includea default prefix equal to null. The Use_aliases field 534 may provide aBoolean flag that indicates whether the NMS 110 is accepting aliasesassociated with the network device 120 via a subscription channel. Whenthe Boolean flag is set to true, the network device 120 may createaliases for paths within the subscription. Any aliases defined by thenetwork device must be created separately from an update to thecorresponding data item(s).

The qos field 535 corresponds to a packet marking utilized for thecreation of the SubscribeResponse 540. The qos field 535 may include asingle sub-value marking (e.g., packet header) which indicates aDifferentiated Services Code Point (DSCP) value as a 32-bit unsignedinteger. In scenarios when the qos field 535 is not specified, thenetwork device 120 may stream telemetry data using a default DSCPmarking for management-plane traffic.

The Allow_aggregation field 536 of the SubscriptionList message 530 mayprovide a Boolean value for use by the NMS 110 to allow schema elementsmarked eligible as aggregation capable for combining into singletelemetry update messages (e.g., SubscribeResponse 540 RPCs). In someexamples, aggregation is not used by default. Where aggregation ispermitted by both the NMS 110 and the specified data schema, each updatemessage may contain a key value pair, where the key must be the path tothe element within the data tree which is explicitly marked as beingeligible for aggregation by the data schema defining it. In someexamples, the value must be an object which encodes the children of thedata tree element specified. For JSON, the value is therefore a JSONobject, and for Protobuf is a series of binary-encoded Protobuf

The Use_models field 537 provides a model data message specifying thedata schema(s) for use by the network device 120 when creating asubscription. In some examples, when the Use_model field 537 specifies aspecific data schema, the network device 120 must only consider dataelements within the specified data schema. Otherwise, the network device120 may consider all data elements defined by every data schemasupported by the network device 120. The NMS 110 may obtain the dataschemas supported by the network device 120 from the Supported Modelsfield 242 (FIG. 2B) within the CapabilityResponse 240 (FIG. 2B) returnedfrom the network device 120. As set forth above, the model data messagemay contain the name field associated with the name of the modelexpressed as a string, the organization filed associated with theorganization publishing the model expressed as a string, and the versionfield associated with the supported version of the model expressed as astring.

The network device 120 creates messages based on the type ofsubscription specified in the received SubscribeRequest 520 and at thefrequency requested by the NMS 110. The subscriptions correspond to aset of paths (i.e., defined in the Subscribe field 522 of the receivedSubscribeRequest 520) which cannot be modified throughout the lifetimeof the subscription. In order to cancel a subscription, the NMS 110 mustclose the gRPC channel over which the SubscribeRequest 520 RPC wasinitiated, or terminate the entire gRPC session with the network device120. Subscriptions are fundamentally a set of independent updatemessages included in SubscribeResponse 540 RPCs that relate to the stateof the data tree. In other words, it is not possible for the NMS 110requesting a subscription to assume that the set of update messagesreceived with in the SubscribeResponse 540 RPCs represent a snapshot ofthe data tree at a particular point in time. Subscriptions thereforeallow the NMS 110 to (1) receive ongoing updates (i.e., the STREAMsubscription 532 b) from the network device 120 to allow synchronizationbetween the NMS 110 and the network device 120 for the state of elementswithin the data tree, and (2) receive a single view (i.e., the ONCEsubscription 532 a or the POLL subscription 532 c) for elements of thedata tree on a per-data element basis according to the state of theelements at the time the SubscribeRequest 520 is transmitted. In thecase of the STREAM subscription 532 b, the NMS 110 receives an initialset of updates, receives a message indicating that initialsynchronization is complete, and receives subsequent updates indicatingchanges to the initial state of those elements. In the case of thesingle view subscriptions (e.g., the ONCE subscription 532 a or the POLLsubscription 532 c), the network device 120 does not have to coalescevalues into a single snapshot view as with the GetResponse 340, orcreate an additional in-memory representation of the subtree at the timerequest and subsequently transmit the entire view to the NMS 110.

Referring to FIG. 5B, the SubscribeResponse 540 returned from thenetwork device 120 to the NMS 110 over the channel established by thecorresponding SubscribeRequest 520 includes a set of response fieldsthat includes an Update field 542, a Sync Response field 544, and theError field 546. The Update field 542 includes notification messagesthat provide an update value for a specified path and a timestamp 350field indicating a time at which the network device 120 collected thevalue of the path being updated. In some implementations, when a leafnode's value has changed, or a new node has been created, an updatemessage specifying the path and value for the updated data item must beappended to Update field 542 of the SubscribeResponse 540. In someexamples, when a node within the subscribed paths has been removed, adelete field of the notification message must have the path of theremoved node appended to the Update field 542. Moreover, thenotification message of the Update field 542 may specify an aliaseddefined by the network device 120 and include an aliased path within aprefix field, and an on-null alias field.

In some implementations, the SubscribeResponse 540 having the SyncResponse field 544 set to true must transmit to the NMS 110 to indicatethat the initial transmission of an initial update has concluded whenthe network device 120 completes transmission of the initial updates forall paths specified within the SubscriptionList 530 of theSubscribeRequest 520. In doing so, the NMS 110 is informed that allexisting data for the subscription has been transmitted by the networkdevice 120 at least once. In some examples, following the transmissionof all updates corresponding to the data items within the set pathsspecified within the SubscriptionList 530 of the SubscribeRequest 520,the channel over which the corresponding SubscribeRequest was receivedmust be closed.

FIG. 6 is a diagram 600 illustrating example operations performed by theNMS 110 and the network device 120 when the NMS 110 requests acommunication session with the network device 120. At operation 602, theNMS 110 transmits a request 22 for the communication session with thenetwork device 120, and at operation 604, the network device 120 acceptsthe communication session and provides a response 24 informing the NMS110 that the communication session is accepted. A specified protocol(e.g., gRPC-based protocol) allows for bi-directional telemetrycommunications 20 between the NMS 110 and the network device 120 for thecommunication session. In some examples, the communication session ismutually authenticated. At operation 606, the NMS 110 may transmit theCapabilityRequest 220 to the network device 120 to request capabilityinformation 230 therefrom. At operation 608, the network device 120transmits the CapabilityResponse 240 to the NMS 110. TheCapabilityResponse 240 includes the requested capability information230. The capability information 230 may include the supported modelsfield 242, the supported encodings field 244, and the version field 246of FIG. 2B.

In some implementations, the NMS 110 uses the capability information 230returned from the network device 120 when transmitting subsequentrequests 22 to the network device 120. For instance, at operation 610,the NMS 110 transmits a request 22 to the network device 120 thatincludes one of the GetRequest 320, the SetRequest 420, or theSubscribeRequest 520. Any of the requests 320, 420, 520 received by thenetwork device 120 at operation 612 may specify one or more data schemasand/or encodings supported by the network device 120 for use whenreturning the corresponding GetResponse 340, SetResponse 440, orSubscribeResponse 540. In some examples, the NMS 110 discovers theencodings and/or data schemas supported by the network device 120 fromthe corresponding supported models field 242 and/or the correspondingsupported encodings field 244 within the capability information 230 ofthe CapabilityResponse 240.

The GetRequest 320 specifies a set of paths identifying data 21 on thenetwork device 120 and may optionally specify one or more types of thedata 21. The types may include one or more of configuration information342, state information 344, or operational information 346. If theGetRequest 320 does not specify the one or more types of the requesteddata 21, the network device 120 may retrieve each one of theconfiguration information 342, the state information 344, and theoperational information 346 existing on the network device 120 when theGetRequest 320 is received.

The SetRequest 420 specifies one or more operations 442 for the networkdevice 120 to process. The operations 442 may include a delete operationspecified in a Delete field 422 of the SetRequest 420, a replaceoperation specified in a Replace field 424 of the SetRequest 420, and/oran update operation specified in an Update field 426 of the SetRequest420.

The SubscribeRequest 520 is configured to allow the NMS 110 to subscribeto updates for requested data 21 existing on the network device 120. TheSubscribeRequest 520 may specify a set of paths (e.g., within theSubscription field 531 of the SubscriptionList Message 530) identifyingthe requested data 21 and a subscription mode 532 that indicatestriggers for the network device to return the updates for the requesteddata 21 to the NMS 110. The subscription mode 532 may be set to one of aONCE subscription 532 a, a STREAM subscription 532 b, or a POLLsubscription 532 c.

At operation 612, the network device 120 transmits the correspondingGetResponse 340, SetResponse 440, or SubscribeResponse 540. TheGetResponse 340 includes a corresponding notification message for eachpath specified by the GetRequest 320 previously received. Referring toFIG. 3, each notification message may include a snapshot of therequested data 21 for the corresponding path and a timestamp TS 350indicating a time at which the network device 120 took the snapshot ofthe requested data 21 for the corresponding path. At operation 612, theNMS 110 utilizes the data 21 provided in the corresponding GetResponse340, SetResponse 440, or SubscribeResponse 540.

The SetResponse 440 includes a message field 444, indicating whether ornot an entire transaction associated with the SetRequest 420 wassuccessful, and an UpdateResult response 446 a-n for each operation 442specified by the SetRequest 420. If the network device 120 is unable toprocess any one of the operations 442, the entire transaction fails andthe message field 444 includes an error message informing the NMS 110 ofthe failed transaction. Each UpdateResult response 446 a-n indicates avalue for the corresponding processed operation (e.g., set equal to oneof Delete, Replace, or Update) and an element of the requested data 21modified by the corresponding processed operation 442. For operation 442that the network device 120 is unable to process, the correspondingUpdateResult response 446 a-n may provide an error message within anError field 454 to inform the NMS 110 that the network device 120 isunable to process the corresponding operation 442.

The SubscribeResponse 540 includes an Update field 542 having one ormore notification messages each providing an update value for acorresponding path specified by the SubscribeRequest 520. For the ONCEsubscription 532 a or the POLL subscription 532 c, the network device120 may retrieve the requested data 21 on a per-data element basis at atransmission time of the SubscribeRequest 520 and thereafter encapsulatethe retrieved data 21 into the SubscribeResponse 540 for transmission tothe NMS 110. For the STREAM subscription 532 b specified in the OnChange mode, the network device 120 transmits the SubscribeResponse 540each time the updated value for the corresponding path specified by theSubscribeRequest 520 updates. For the STREAM subscription 532 bspecified in the Sampled mode, the network device 120 transmits theSubscribeResponse 540 during a sample interval specified by the STREAMsubscription 532 b.

FIG. 7 is schematic view of an example computing device 700 (e.g. dataprocessing hardware) that may be used to implement the systems andmethods described in this document. The computing device 700 is intendedto represent various forms of digital computers, such as laptops,desktops, workstations, personal digital assistants, servers, bladeservers, mainframes, and other appropriate computers. The componentsshown here, their connections and relationships, and their functions,are meant to be exemplary only, and are not meant to limitimplementations of the inventions described and/or claimed in thisdocument. The network device 120 may implement the computing device 700.Additionally or alternatively, the network management system 110 mayimplement the computing device 700.

The computing device 700 includes a processor 710 (e.g., data processinghardware), memory 720, a storage device 730, a high-speedinterface/controller 740 connecting to the memory 720 and high-speedexpansion ports 750, and a low speed interface/controller 760 connectingto low speed bus 770 and storage device 730. Each of the components 710,720, 730, 740, 750, and 760, are interconnected using various busses,and may be mounted on a common motherboard or in other manners asappropriate. The processor 710 can process instructions for executionwithin the computing device 700, including instructions stored in thememory 720 or on the storage device 730 to display graphical informationfor a graphical user interface (GUI) on an external input/output device,such as display 780 coupled to high speed interface 740. In otherimplementations, multiple processors and/or multiple buses may be used,as appropriate, along with multiple memories and types of memory. Also,multiple computing devices 700 may be connected, with each deviceproviding portions of the necessary operations (e.g., as a server bank,a group of blade servers, or a multi-processor system).

The memory 720 stores information non-transitorily within the computingdevice 700. The memory 720 may be a computer-readable medium, a volatilememory unit(s), or non-volatile memory unit(s). The non-transitorymemory 720 may be physical devices used to store programs (e.g.,sequences of instructions) or data (e.g., program state information) ona temporary or permanent basis for use by the computing device 700.Examples of non-volatile memory include, but are not limited to, flashmemory and read-only memory (ROM)/programmable read-only memory(PROM)/erasable programmable read-only memory (EPROM)/electronicallyerasable programmable read-only memory (EEPROM) (e.g., typically usedfor firmware, such as boot programs). Examples of volatile memoryinclude, but are not limited to, random access memory (RAM), dynamicrandom access memory (DRAM), static random access memory (SRAM), phasechange memory (PCM) as well as disks or tapes.

The storage device 730 is capable of providing mass storage for thecomputing device 700. In some implementations, the storage device 730 isa computer-readable medium. In various different implementations, thestorage device 730 may be a floppy disk device, a hard disk device, anoptical disk device, or a tape device, a flash memory or other similarsolid state memory device, or an array of devices, including devices ina storage area network or other configurations. In additionalimplementations, a computer program product is tangibly embodied in aninformation carrier. The computer program product contains instructionsthat, when executed, perform one or more methods, such as thosedescribed above. The information carrier is a computer- ormachine-readable medium, such as the memory 720, the storage device 730,or memory on processor 710.

The high speed controller 740 manages bandwidth-intensive operations forthe computing device 700, while the low speed controller 760 manageslower bandwidth-intensive operations. Such allocation of duties isexemplary only. In some implementations, the high-speed controller 740is coupled to the memory 720, the display 780 (e.g., through a graphicsprocessor or accelerator), and to the high-speed expansion ports 750,which may accept various expansion cards (not shown). In someimplementations, the low-speed controller 760 is coupled to the storagedevice 730 and low-speed expansion port 770. The low-speed expansionport 770, which may include various communication ports (e.g., USB,Bluetooth, Ethernet, wireless Ethernet), may be coupled to one or moreinput/output devices, such as a keyboard, a pointing device, a scanner,or a networking device such as a switch or router, e.g., through anetwork adapter.

The computing device 700 may be implemented in a number of differentforms, as shown in the figure. For example, it may be implemented as astandard server 700 a or multiple times in a group of such servers 700a, as a laptop computer 700 b, or as part of a rack server system 700 c.

FIG. 8 illustrates an example arrangement of operations for a method 800for communicating between a network management system (NMS) 110 and anetwork device 120 over specified protocol enabling bi-directionalstreaming therebetween. The flowchart starts at operation 802 when dataprocessing hardware 700 of the network device 120 receives aCapabilityRequest 220 from the NMS 110 for capability information 230 onthe network device 120. At operation 804, the data processing hardware700 transmits a CapabilityResponse 240 including the capabilityinformation 230 to the NMS 110 via telemetry. The capability information230 may include one or more data schemas supported by the network device120.

At operation 806, the data processing hardware 700 receives a datarequest 320, 520 from the NMS 110 requesting data 21 including at leastone of configuration information 342 or state information 344. The datarequest 320, 520 specifies at least one of the data schemas supported bythe network device 120 for use by the network device 120 when returningthe requested data 21 to the NMS 110.

At operation 808, the data processing hardware 700 transmits a dataresponse 340, 540 to the NMS 110 via telemetry. The data response 340,540 includes the requested data 21 having data elements defined by thespecified at least one data schema. The capability and data requests220, 320, 520 and the capability and data responses 240, 340, 540 adhereto the specified protocol/

A software application (i.e., a software resource) may refer to computersoftware that causes a computing device to perform a task. In someexamples, a software application may be referred to as an “application,”an “app,” or a “program.” Example applications include, but are notlimited to, system diagnostic applications, system managementapplications, system maintenance applications, word processingapplications, spreadsheet applications, messaging applications, mediastreaming applications, social networking applications, and gamingapplications.

The non-transitory memory may be physical devices used to store programs(e.g., sequences of instructions) or data (e.g., program stateinformation) on a temporary or permanent basis for use by a computingdevice. The non-transitory memory may be volatile and/or non-volatileaddressable semiconductor memory. Examples of non-volatile memoryinclude, but are not limited to, flash memory and read-only memory(ROM)/programmable read-only memory (PROM)/erasable programmableread-only memory (EPROM)/electronically erasable programmable read-onlymemory (EEPROM) (e.g., typically used for firmware, such as bootprograms). Examples of volatile memory include, but are not limited to,random access memory (RAM), dynamic random access memory (DRAM), staticrandom access memory (SRAM), phase change memory (PCM) as well as disksor tapes.

Various implementations of the systems and techniques described hereincan be realized in digital electronic and/or optical circuitry,integrated circuitry, specially designed ASICs (application specificintegrated circuits), computer hardware, firmware, software, and/orcombinations thereof. These various implementations can includeimplementation in one or more computer programs that are executableand/or interpretable on a programmable system including at least oneprogrammable processor, which may be special or general purpose, coupledto receive data and instructions from, and to transmit data andinstructions to, a storage system, at least one input device, and atleast one output device.

These computer programs (also known as programs, software, softwareapplications or code) include machine instructions for a programmableprocessor, and can be implemented in a high-level procedural and/orobject-oriented programming language, and/or in assembly/machinelanguage. As used herein, the terms “machine-readable medium” and“computer-readable medium” refer to any computer program product,non-transitory computer readable medium, apparatus and/or device (e.g.,magnetic discs, optical disks, memory, Programmable Logic Devices(PLDs)) used to provide machine instructions and/or data to aprogrammable processor, including a machine-readable medium thatreceives machine instructions as a machine-readable signal. The term“machine-readable signal” refers to any signal used to provide machineinstructions and/or data to a programmable processor.

The processes and logic flows described in this specification can beperformed by one or more programmable processors executing one or morecomputer programs to perform functions by operating on input data andgenerating output. The processes and logic flows can also be performedby special purpose logic circuitry, e.g., an FPGA (field programmablegate array) or an ASIC (application specific integrated circuit).Processors suitable for the execution of a computer program include, byway of example, both general and special purpose microprocessors, andany one or more processors of any kind of digital computer. Generally, aprocessor will receive instructions and data from a read only memory ora random access memory or both. The essential elements of a computer area processor for performing instructions and one or more memory devicesfor storing instructions and data. Generally, a computer will alsoinclude, or be operatively coupled to receive data from or transfer datato, or both, one or more mass storage devices for storing data, e.g.,magnetic, magneto optical disks, or optical disks. However, a computerneed not have such devices. Computer readable media suitable for storingcomputer program instructions and data include all forms of non-volatilememory, media and memory devices, including by way of examplesemiconductor memory devices, e.g., EPROM, EEPROM, and flash memorydevices; magnetic disks, e.g., internal hard disks or removable disks;magneto optical disks; and CD ROM and DVD-ROM disks. The processor andthe memory can be supplemented by, or incorporated in, special purposelogic circuitry.

To provide for interaction with a user, one or more aspects of thedisclosure can be implemented on a computer having a display device,e.g., a CRT (cathode ray tube), LCD (liquid crystal display) monitor, ortouch screen for displaying information to the user and optionally akeyboard and a pointing device, e.g., a mouse or a trackball, by whichthe user can provide input to the computer. Other kinds of devices canbe used to provide interaction with a user as well; for example,feedback provided to the user can be any form of sensory feedback, e.g.,visual feedback, auditory feedback, or tactile feedback; and input fromthe user can be received in any form, including acoustic, speech, ortactile input. In addition, a computer can interact with a user bysending documents to and receiving documents from a device that is usedby the user; for example, by sending web pages to a web browser on auser's client device in response to requests received from the webbrowser.

A number of implementations have been described. Nevertheless, it willbe understood that various modifications may be made without departingfrom the spirit and scope of the disclosure. Accordingly, otherimplementations are within the scope of the following claims.

What is claimed is:
 1. A method comprising: receiving, at dataprocessing hardware of a network device, a capability request from anetwork manager for capability information on the network device;transmitting, from the data processing hardware of the network device tothe network manager via telemetry, a capability response comprising thecapability information, the capability information comprising dataschemas supported by the network device, encodings supported by thenetwork device, and a version of a network management interface servicesupported by the network device; receiving, at the data processinghardware of the network device, a request from the network managerrequesting data comprising at least one of state information orconfiguration information, the request specifying one or more of (i) thedata schemas and/or (ii) the encodings supported by the network devicefor use by the network device when returning the requested data to thenetwork manager, the request comprising: a get request to obtain asnapshot of the requested data existing on the network device; or asubscribe request to subscribe to updates for the requested dataexisting on the network device; transmitting a data response from thedata processing hardware to the network manager via telemetry, the dataresponse comprising the requested data having data elements defined bythe specified one or more of (i) the data schemas and/or (ii) theencodings supported by the network device; receiving, at the dataprocessing hardware of the network device, a set request from thenetwork manager, the set request specifying a set of two or moreoperations for the network device to process, each operation in the setof two or more operations specified by the set request comprising anyone of a delete operation, a replace operation, or an update operation;and transmitting a set response from the data processing hardware to thenetwork manager via telemetry, the set response indicating whether ornot the network device successfully processed all of the operations inthe set of two or more operations specified by the set request, whereinthe data and set requests and the data and set responses adhere to aprotocol configured to enable bi-directional streaming between thenetwork manager and the network device.
 2. The method of claim 1,wherein the get request specifies a set of paths identifying therequested data within one or more schema definition models restricted byat least one of the data schemas supported by the network device for useby the network device when returning the requested data to the networkmanager.
 3. The method of claim 2, wherein the get request specifies atleast one of the encodings supported by the network device for use bythe network device when serializing the set of paths.
 4. The method ofclaim 2, wherein transmitting the data response comprises transmitting aget response comprising a corresponding notification message for eachpath specified by the get request, each notification message comprisingthe snapshot of the requested data for the corresponding path and atimestamp field indicating a time at which the network device took thesnapshot of the requested data for the corresponding path.
 5. The methodof claim 1, wherein the subscribe request specifies a set of pathsidentifying the requested data within one or more schema definitionmodels restricted by at least one of the data schemas supported by thenetwork device and a subscription mode that indicates triggers for thenetwork device to return the updates for the requested data to thenetwork manager.
 6. The method of claim 5, wherein transmitting the dataresponse comprises transmitting a subscribe response comprising anupdate field including one or more notification messages each providingan update value for a corresponding path specified by the subscriberequest.
 7. The method of claim 6, further comprising, when thesubscription mode specified by the subscribe request comprises aperiodically-polled subscription: retrieving, by the data processinghardware of the network device, the requested data on a per-data elementbasis from memory hardware in communication with the data processinghardware at a transmission time of the subscribe request; andencapsulating, by the data processing hardware of the network device,the requested data into the subscribe response.
 8. The method of claim6, further comprising, when the subscription mode specified by thesubscribe request comprises a one-off subscription: retrieving, by thedata processing hardware of the network device, the requested data on aper-data element basis for each corresponding path specified by thesubscribe request without requiring serialization of the paths specifiedby the subscribe request simultaneously; and encapsulating, by the dataprocessing hardware of the network device, the requested data into thesubscribe response via multiple notification messages.
 9. The method ofclaim 6, wherein transmitting the subscribe response comprises, when thesubscription mode specified by the subscribe request comprises a Streamsubscription: transmitting the subscribe response each time the updatevalue for the corresponding path specified by the subscribe requestchanges; or transmitting the subscribe response during a sample intervalspecified by the Stream subscription, wherein the subscribe responseincludes a timestamp indicating a time at which the requested data wassampled.
 10. The method of claim 1, further comprising, in response toreceiving the set request from the network manager: determining, by thedata processing hardware of the network device, whether the networkdevice is able to process each operation in the set of two or moreoperations specified by the network manager in the set request; and whenthe network device is able to process each operation in the set of twoor more operations specified by the network manager in the set request:processing, by the data processing hardware of the network device, theoperations; and transmitting the set response from the data processinghardware to the network manager, the set response comprising acorresponding update result response for each of the processedoperations, the update result response indicating a value for thecorresponding processed operation and path of an element of therequested data modified by the corresponding processed operation. 11.The method of claim 10, further comprising, when the network device isunable to process at least one of the operations in the set of two ormore operations specified by the network manager, transmitting the setresponse from the data processing hardware to the network manager, theset response comprising a message field providing an error messageindicating that the network device is unable process the set of two ormore operations specified by the network manager in the set request. 12.The method of claim 1, further comprising, prior to transmitting thedata response to the network manager: in response to receiving the datarequest, authenticating, by the data processing hardware of the networkdevice, the network manager; and determining, by the data processinghardware of the network device, whether the network manager isauthorized to access the network device for the requested data, whereinthe network manager transmits the data response to the network managerwhen the network manager is authorized and authenticated.
 13. A networksystem comprising: a network manager; a network device; data processinghardware in communication with the network device; and memory hardwarein communication with the data processing hardware, the memory hardwarestoring instructions that when executing on the data processing hardwarecause the data processing hardware to perform operations comprising:receiving a capability request from the network manager for capabilityinformation on the network device; transmitting a capability responsecomprising the capability information to the network manager viatelemetry, the capability information comprising data schemas supportedby the network device, encodings supported by the network device, and aversion of a network management interface service supported by thenetwork device; receiving a request from the network manager requestingdata comprising at least one of state information, configurationinformation, or operational information, the request specifying one ormore of the data schemas and/or the encodings supported by the networkdevice for use by the network device when returning the requested datato the network manager, the request comprising: a get request to obtaina snapshot of the requested data existing on the network device; or asubscribe request to subscribe to updates for the requested dataexisting on the network device; transmitting a data response to thenetwork manager via telemetry, the data response comprising therequested data having data elements defined by the specified one or moreof (i) the data schemas and/or (ii) the encodings supported by thenetwork device; receiving a set request from the network manager, theset request specifying a set of two or more operations for the networkdevice to process, each operation in the set of two or more operationsspecified by the set request comprising any one of a delete operation, areplace operation, or an update operation; and transmitting a setresponse to the network manager via telemetry, the set responseindicating whether or not the network device successfully processed allof the operations in the set of two or more operations specified by theset request, wherein the data and set requests and the data and setresponses adhere to a protocol configured to enable bi-directionalstreaming between the network manager and the network device.
 14. Thesystem of claim 13, wherein the get request specifies a set of pathsidentifying the requested data within one or more schema definitionmodels restricted by at least one of the data schemas supported by thenetwork device for use by the network device when returning therequested data to the network manager.
 15. The system of claim 14,wherein the get request specifies at least one of the encodingssupported by the network device for use by the network device whenserializing the set of paths.
 16. The system of claim 14, whereintransmitting the data response comprises transmitting a get responsecomprising a corresponding notification message for each path specifiedby the get request, each notification message comprising the snapshot ofthe requested data for the corresponding path and a timestamp fieldindicating a time at which the network device took the snapshot of therequested data for the corresponding path.
 17. The system of claim 13,wherein the subscribe request specifies a set of paths identifying therequested data within one or more schema definition models restricted byat least one of the data schemas supported by the network device and asubscription mode that indicates triggers for the network device toreturn the updates for the requested data to the network manager. 18.The system of claim 17, wherein transmitting the data response comprisestransmitting a subscribe response comprising an update field includingone or more notification messages each providing an update value for acorresponding path specified by the subscribe request.
 19. The system ofclaim 18, further the operations further comprise, when the subscriptionmode specified by the subscribe request comprises a periodically-polledsubscription: retrieving the requested data on a per-data element basisfrom the memory hardware at a transmission time of the subscriberequest; and encapsulating the requested data into the subscriberesponse.
 20. The system of claim 18, wherein the operations furthercomprise, when the subscription mode specified by the subscribe requestcomprises a one-off subscription: retrieving the requested data on aper-data element basis for each corresponding path specified by thesubscribe request without requiring serialization of the paths specifiedby the subscribe request simultaneously; and encapsulating the requesteddata into the subscribe response via multiple notification messages. 21.The system of claim 18, wherein transmitting the subscribe responsecomprises, when the subscription mode specified by the subscribe requestcomprises a Stream subscription: transmitting the subscribe responseeach time the update value for the corresponding path specified by thesubscribe request changes; or transmitting the subscribe response duringa sample interval specified by the Stream subscription, wherein thesubscribe response includes a timestamp indicating a time at which therequested data was sampled.
 22. The system of claim 13, wherein theoperations further comprise, in response to receiving the set requestfrom the network manager: determining whether the network device is ableto process each operation in the set of two or more operations specifiedby the network manager in the set request; and when the network deviceis able to process each operation in the set of two or more operationsspecified by the network manager in the set request: processing theoperations; and transmitting the set response to the network manager,the set response comprising a corresponding update result response foreach of the processed operations, the update result response indicatinga value for the corresponding processed operation and path of an elementof the requested data modified by the corresponding processed operation.23. The system of claim 22, wherein the operations further comprise,when the network device is unable to process at least one of theoperations in the set of two or more operations specified by the networkmanager, transmitting the set response to the network manager, the setresponse comprising a message field providing an error messageindicating that the network device is unable process the set of two ormore operations specified by the network manager in the set request. 24.The system of claim 13, wherein the operations further comprise, priorto transmitting the data response to the network manager: in response toreceiving the data request, authenticating the network manager; anddetermining whether the network manager is authorized to access thenetwork device for the requested data, wherein the network managertransmits the data response to the network manager when the networkmanager is authorized and authenticated.